Server Logs – March 2007
Here are some of the more interesting (I use interesting very loosely) lines in the server log for March.
1.
68.231.xxx.xx - - [01/Mar/2007:11:29:36 -0500] "GET /.rss/all HTTP/1.1" 200 17439 "http://www.google.com/search?q=+used+dye+dm7&hl=en&safe=active&start=20&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
From: Google – used dye dm7
Browser: MSIE 6.0
Request: http://pbbucket.com/.rss/all
This is more of an annoyance of mine. I don't think Google should index RSS feeds. I have never found an RSS feed useful when I was searching. It just fuzzes the results. I'll write a post dedicated to this soon.
2.
131.107.0.95 - - [01/Mar/2007:13:20:59 -0500] "GET / HTTP/1.1" 200 8426 "http://search.live.com/result.aspx?q=ultracet&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1; .NET CLR 2.0.50727)"
131.107.0.95 - - [01/Mar/2007:13:40:47 -0500] "GET /chat/ HTTP/1.1" 200 7957 "http://search.live.com/result.aspx?q=ultram&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1)"
131.107.0.95 - - [01/Mar/2007:13:40:44 -0500] "GET / HTTP/1.1" 302 0 "http://search.live.com/result.aspx?q=ultram&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1)"
131.107.0.95 - - [01/Mar/2007:04:44:59 -0500] "GET / HTTP/1.1" 302 0 "http://search.live.com/result.aspx?q=tramadol&mrt=en-us&FORM=LVSP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1; .NET CLR 2.0.50727)"
From: Live – tramadol, ultram, ultracet
Browser: MSIE 6.0
Request: http://diabloowners.com/ http://beta.diabloowners.com/chat/
Now, these don't make sense. Nothing related to my sites are anywhere near a search for that. It seems like some sort of referrer spam, but who is it helping? Is it trying to make you search for those to maybe click some ads, or link to some site on the search list? I really don't know.
What is also interesting is that the reverse dns is tide525.microsoft.com. So is it Microsoft spam to make you search for those (since you want to see if your site is listed), and to click one of the ads?
3.
65.96.xxx.xxx - - [07/Mar/2007:05:01:59 -0500] "GET / HTTP/1.1" 200 4566 "http://www.google.com/search?hl=en&q=making+scripts+for+firefox&btnG=Search" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 Firefox/2.0.0.2"
From: Google – making scripts for firefox
Browser: Firefox 2 (Windows XP)
Request: http://scripts.diabloowners.com
I'm the number 2 result for that query. I'm on page 8 of the more sensible search 'making firefox scripts'. Anyways, to help you out, diveintogreasemonkey. It's what I used to make PbN Pro.
4.
68.46.xxx.xx - - [12/Mar/2007:23:21:58 -0500] "GET /pbnation.src HTTP/1.1" 200 4566 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.2pre) Gecko/20070220 BonEcho/2.0.0.2pre"
68.46.xxx.xx - - [12/Mar/2007:23:21:58 -0500] "GET /pbnicon.png HTTP/1.1" 200 4566 "-" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.2pre) Gecko/20070220 BonEcho/2.0.0.2pre"
From: Search plugin
Browser: Firefox 2 (Mac OS X)
Request: http://scripts.diabloowners.com/pbnation.src http://scripts.diabloowners.com/pbnicon.png
Woohoo! Someone is still using my search plugin I made for PbNation. Easy to make, but pretty useful. Too bad Pbnation decided to say 'Fuck You' to our relationship. If you still want it, I might be able to find the source of it around here somewhere.
5.
216.162.xx.x - - [13/Mar/2007:12:50:44 -0500] "GET / HTTP/1.1" 200 4566 "http://www.google.com/search?client=safari&rls=en&q=pbnation+ed+rieker&ie=UTF-8&oe=UTF-8" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418.9.1 (KHTML, like Gecko) Safari/419.3"
From: Google – pbnation ed rieker
Browser: Safari
Request: http://scripts.diabloowners.com/
Yay for being the first result! I moved up a few.
6.
66.156.xx.xxx - - [13/Mar/2007:19:23:34 -0500] "GET /?p=44 HTTP/1.1" 200 12171 "http://search.blogger.com/?q=ndiswrapper&ie=UTF-8&scoring=d&ui=blg&sa=N&start=10" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2) Gecko/20070208 Iceweasel/2.0.0.2 (Debian-2.0.0.2+dfsg-3)"
From: Search.Blogger.com – ndiswrapper
Browser: Iceweasel
Request: http://ja.meswilson.com/blog/?p=44
My first request from Iceweasel, whose sole purpose is to be ridiculous and confusing, I mean, is more ethical be being completely free. Also, I didn't know blogger's search would search blogs outside of the blogger realm. Learn something new everyday.
7.
68.55.xxx.xxx - - [17/Mar/2007:14:34:43 -0500] "GET /index.php HTTP/1.1" 200 49894 "http://www.google.com/search?hl=en&client=firefox-a&rls=com.ubuntu%3Aen-US%3Aofficial&hs=A5y&q=ubuntu+feist+fawn+dvd+play&btnG=Search" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2) Gecko/20061201 Firefox/2.0.0.2 (Ubuntu-feisty)"
From: Google – feist fawn dvd play
Browser: Firefox 2 (Ubuntu – Feisty Fawn)
Request: http://ja.meswilson.com/blog/
I'm on the first page for the search of feist fawn. Apparently, when other people write about Feisty Fawn, they don't forget the 'y'. If you really wanted, you could get probably get the first result for 'feist fawn' query, which is an easy spelling mistake to make.
8.
75.46.xxx.xxx - - [19/Mar/2007:00:38:54 -0500] "GET /?feed=rss2 HTTP/1.1" 307 0 "http://www.google.com/search?hl=en&q=netgear+wg311+v3+driver+for+OS+X86" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; InfoPath.2)"
From: Google – netgear wg311 v3 driver for OS X86
Browser: MSIE 7.0 (Vista)
Request: http://ja.meswilson.com/blog/feed/
OSx86? Swing and a miss.
9.
70.160.xxx.xx - - [21/Mar/2007:22:06:47 -0500] "GET /user/NotYourPsycho/ HTTP/1.1" 200 15734 "http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLJ,GGLJ:2006-42,GGLJ:en&q=notyourpsycho" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)"
From: Google – notyourpsycho
Browser: MSIE 7.0
Request: http://pbbucket.com/user/NotYourPsycho/
This isn't the first time someone has been searching for NotYourPsycho. She, yes, apparently girls are on the internet, was, and probably still is, a PbNation user that mainly posted in the Newbie OT that Calv invited to PbBucket back in an early beta stage (not like the beta stages really are that much different). I'm not sure if someone is stalking her, or that she just likes to find out who is talking about her. I'm going with the latter.
10.
68.111.xxx.xxx - - [27/Mar/2007:22:05:10 -0500] "GET / HTTP/1.1" 200 4566 "http://www.google.com/search?hl=en&q=PbNation+LLC&btnG=Google+Search" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
From: Google – PbNation LLC
Browser: Firefox 2 (Windows XP)
Request: http://scripts.diabloowners.com/
Second result suckers!
11.
58.187.129.209 - - [29/Mar/2007:22:20:36 -0500] "GET /submit.php HTTP/1.1" 302 0 "http://www.google.com/search?q=big+top+%22submit.php%22&hl=en&start=520&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
From: Google – big top "submit.php"
Browser: MSIE 6.0
Request: http://pbbucket.com/submit.php
12.
68.117.xx.xxx - - [27/Mar/2007:19:01:45 -0500] "GET /?p=17 HTTP/1.1" 200 16631 "http://www.google.com/search?q=Vista+TimerLock+Doesnt+Work&hl=en&safe=off&start=10&sa=N" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3"
From: Google – Vista TimerLock Doesnt Work
Browser: Firefox 2 (Vista)
Request: http://ja.meswilson.com/blog/?p=17
Nope, TimerLock is broken now. Try searching for vista+paradox, and see what turns up.
I'm seeing the same thing as #2, Live sending weird traffic.
Same as you it's all coming from the same IP address. I searched all of my server logs for that IP and they have been all over most of my sites.